Important Security Notice

In the very early morning of 8th November 2019 we noticed suspicious activity by a potentially malicious third party actor against our services. Using an exploit in our legacy codebase, our logs confirm that they accessed a small number of user records from the old user service.

Even though we were able to secure the endpoint as soon as we discovered the exploit, as a measure of security, we are informing all of you, as we cannot rule out that further access to other user data including email addresses, password hashes and password salts has taken place.

We immediately worked to rectify the situation and, as part of the process, brought forward our release schedule for our long-planned new user service to ensure no other potential exploits on the old user service could be used to obtain user data. This step we took is ensuring that the new passwords are not only better protected, but that any encrypted passwords that have - potentially - been obtained from the old user service are already out of date.

Further, and as is required by law, we have informed the ICO about this incident and we are in the process of fulfilling our obligations related to the matter.

What does this mean for you?

While we noticed the suspicious activity on 8th November 2019, and we have no evidence of past activity in our logs, we cannot say for certain whether the exploit had been used before, and thus cannot ascertain how many - if any - email addresses, password hashes and salts were accessed.

Recognising our obligation to all of you, however, we are strongly urging you to be vigilant of potential phishing and credential stuffing attacks.

General Recommendations

If you haven’t already, please log out and back in, in order to update your account and password and migrate to the new user service. If you’ve already used the new user service, then there is no need to change your password again.

If you were using the same password you had on our old user service on other sites, please, change your password on these other sites as soon as possible.

We strongly recommend using a password manager and to not reuse passwords across sites.

Always use unique and strong passwords of at least 12 characters for each service you use.

Consider using Two-Factor Authentication, especially if you are a mod author.

285 comments

IT engineer here. You know what the absolute worst thing is for password security? Complex passwords. Counter-intuitive, I know, right? But longer and more complex passwords lead to people reusing more passwords and saving them in Word or Excel documents on their desktops. That's why Microsoft has minimal complexity requirements but encourages (and in some cases requires) MFA. And the cool thing about MFA? A 6 character simple password is no less secure (and arguably more secure) than a 12 character complex password as long as you use MFA.

And what's funny is seeing supposed security people talk about brute forcing like it's still how accounts get cracked. "Gotta make the passwords harder to guess!" as if anybody's trying to guess it. Nah, legit hackers don't brute force anymore. If they want your password, they send you phishing e-mails, malware with keyloggers, malware that takes advantage of password manager vulnerabilities (and you thought that would keep you safe), or the real good ones take advantage of website vulnerabilities to steal hashes (oh, look, what happened to Nexus). I do still see brute force attacks, but only in business and they're pretty lazy attacks against outdated protocols where the attacker figures "if they're still using PPTP then they're probably using stupid simple passwords".

But what this really boils down to is Nexus screwed up by having bad security and instead of fixing their $%^& they make their users jump through hoops that meet (outdated) "security best practices" but don't actually improve security.

Umh... like any other common application nowadays? Either use MFA via phone or E-mail? It's an extra layer of security after all, one which can very very hardly be cracked in any way outside of mistakes from the user-side.

Hardly, everything is possible... but that's stuff which should be common practice by now and luckily is for many companies handling sensible data.

I am also an IT major, with a cyber security concentration. I gotta say, a true hacker isn't even going to go for the small fry's "12 character long" password. They're just gonna go directly hack the admins, which would give them access to all of the users passwords, even the 12 character long ones. The sad matter is that many of the vulnerabilities that are associated with these kind of breaches doesn't have anything to do with the nexus. It's Windows. Windows is extremely exploitable, perhaps one of the most exploitable software in history (even if its just my opinion).In fact you could go in your windows computer right now, and delete an important file you need in order to operate your computer, and completely destroy your software. If you can do this, a hacker can do the same thing. No, the real thing that needs to be protected is not just the data, but the actual database. In where if software is compromised, it can easily affect the company. From what I'm seeing, nexus mod's website is still slightly old fashioned compared to what could be improved, this is just from a glance.

In terms of constant mod manager updates, you gotta keep in mind that the actual files for the mods are also old fashioned, and if it isn't, trust me, it will be, I'd be shocked if it wasn't) , and so the way they're handled can be old fashioned as well. Not every user on the nexus is computer savvy in wanting to upgrade to vortex, many are nervous they'll lose their mods, even the slightest change can destroy their whole game. It's that finicky, and so it's very stressful for them to not only create a hard to remember password that usually doesn't stop hacking attempts, but upgrade to completely new managers while installing, uninstalling mods. Very stressful!This discourages new users, and makes old users wanna move on.

Also another vulnerability, there are many spam users that serve as bots. With Hackers becoming more advanced in programming, and not to mention desperate, they're finding new ways to get their software to get past the CAPTCHA, I think they're Youtube videos that show programs doing this. This combined with a super fluency of bots can further harm the confidentiality of the network.The bots are the huge portion of why the nexus is being compromised so many different ways. As time goes on, these new gen bots capable of passing CAPTCHA (so like over 1,000 bots able to do this) this is gunna butcher the entire site and be very difficult to keep up with, as I'm sure admins do all day is remove fake user accounts for spam. I can go on about what different improvements can be done.

Another fun note for those who wanna keep reading, it talks about the utilization of demilitarized zones

Spoiler:

Show

What Nexus and many other networks use in order to prevent unauthorized access from entering the system, is what's called a DMZ. (Demilitarized Zone).

This allows good traffic, such as coworkers and staff, while preventing malicious entry from gaining access such as black hats or script kiddies .DMZs consist of a router, firewall, etc. The stronger the DMZ is, the less likely you'll be gaining access. On the user side, you're able to get in no problem, but the trick is to make it so that despite your privileges you cannot access restricted areas. But devs can. If your DMZ is too strong, then nobody will be able to gain entry, this includes staff that really need to, its like a house with no windows and doors, keeps thieves out, but also keeps the home owner out too. If you think about it, an overpowered password system begins to take the role of an overpowered dmz, in where users can't get in as easily, and have a hard time gaining access to their house(the network; their user profile) A bank their serves like this for good reason, however they too struggle when their customers can't gain access to their account when they need to. Its a give and take, the more money a criminal is likely to steal, the greater you need to make your dmz. The less likely a robber will get away with much, the more laxed a dmz can be to allow a continuous flow of the company, and a smooth availability of the network.

Is this related to that time many accounts were exposed in a data breech and passwords stolen while the site Admin, or whoever, failed to inform Nexus users of the breech until much later? Perhaps I'm wrong about action being taken to inform of the breech, but I cannot remember ever being informed unless it had been posted via Nexus Site news back then. Fortunately for me, the password I used back then was only used on the Nexus. I received an email from a hacker trying to con me out of bit coins by attempt to scare me by flashing an old Nexus password. I was able to trace the breech back to Nexus mods via a (Have I been had check) which is where I first found out about the Nexus breech.

Regardless, I barely have any trust in this site anymore . Of course I still use Nexus, but I find it funny the site actually wants us to buy premium for faster downloads when I would not even trust this site with a phone number. LOL

My Avast told me it had safely aborted a connection to Skyrimgems.com because it was infected with HTML:script-inf(susp) Could someone clarify have I downloaded an infected file from Nexus or is this something else?

Get rid of Avast altogether (it's bad nowadays), and use something better - or, if you are on Windows 10 (and version 1903 or HIGHER), use the built-in protection.

This comes from 5+ years of personally USING THEIR SOFTWARE. Their code is so filled with bugs that it's a miracle that my PC hasn't required me to reinstall Windows from scratch yet.

(not listing every issue I have with Avast - the final straw I had with 'em was with their exclusion system not working AT ALL - quarantining files THAT I PUT ON THAT LIST as "malicious & dangerous" - EVEN THOUGH THOSE FILES WERE 100% CLEAN.)

I used Avast for around 2 years and found myself reinstalling Windows 2 times because of false positives on system files which after that had been removed, now I stick to Malwarebytes, it costs money for more protection than just weekly scans but if you donacdum on the internet that should be enough

Totally agree with this. I too was an avid user of Avast 4+ years (and previous to that, used AVG for 3+ years at home). In both cases; I eventually stopped using them because of many false positives which could not be rectified through a controllable whitelisting system, and their reporting mechanism and remedies for these problems was ineffectual.

Thankfully; Microsoft's previously poor AV products have much improved, so I use that for basic cover now. Malwarebytes is a solid product for all the stuff which gets through the cracks. Even the free/trial mode is a life saver. Sometimes I use Sophos too (as I get home license coverage from work). It's always been very solid (due to good support - not just the client software), but it can be a bit over hard on the machine performance for gamer type scenarios. It's best left on your 'work' machine..

Don't make suggestions if you don't know what you are talking about. Windows Defender isn't a bad anti-virus product in real-world scores, it's better than nothing, but it isn't better than Avast. Avast consistently scores better in real-world tests and has less performance impact.

Please limit recommendations to something you have expertise in. If you aren't a doctor or a nurse practitioner, don't hand out medical advice. If you aren't an IT professional, don't hand out anti-virus recommendations.

Malwarebytes is a great tool for removing malware infections, but as an anti-virus platform, it is below the middle of the pack in real-world tests. In short, the performance of it's resident protection modules are unacceptable.

Windows Defender scores in the middle of anti-virus products on the market, in real-world AV tests. . It's better than nothing, but it does not do a much better job than Avast or AVG, both of which consistently score near the top.

*uses the same password across every website* "I can't believe I got hacked" *blames The nexus for getting hacked*

Ppl who use one password for everything are playing with fire, just like people who use easy-to-guess passwords and PIN numbers.

Don't use any personally identifiable information in your passwords, bible verses, famous quotes, lucky numbers, easy-to-guess number combinations (12345, 77777, 6969, birthdays, SSNs, etc.) If someone can go on your social media page and write down everything they know about you and break the password, it wasn't a good password.

What do you want, a badge?Yet another know it all that thinks everyone should have the same grasp as he, let me tell you something, people are different and and MANY can't remember what they go to the toilet for... not everyone has the same outlook as you.Of the 20 million folks here a good number of them wouldn't understand what the hell you were talking about, they might not have spacebook, facetube or even read the bible.You're preaching to those that already understand and others that ain't listening and don't care.I've used the site for 15 years and I still know nothing.

Nope, you're the ignorant one that wishes to assume a level ability playing field, you obviously don't mix with folks with different abilities, after all it's down to the hedgehog to learn when to cross the road isn't it?

@Saggaris You are correct that it is on the website to protect their (your) data to the highest possible standard. However, ultimately it is a user's responsibility to manage their own personal online security. I don't expect everyone to understand this and am well aware they don't as I work in Software Support, however a user refusing or unwilling to learn more about this does not make it any less true. Not defending NexusMods or this breach in any way, just stating a general fact.

I also think posting what you did and the way you did it is completely unnecessary, as @amadeuskun wasn't specifically bashing anyone but in fact was sharing information that could potentially help someone in a situation of having bad passwords.

Remember the hack, when a 100+ megabyte file was replaced with a few kilobytes file (if I remember good) ? How can a 100 digit password help you then? I am not saying that one should not use such passwords, I use combined and different passwords for each account myself, but you know what I am trying to say.I downloaded the file and ran it. Since then, penis extensions offers have been sent to my (dummy) email address

Geeez people you are arguing about usernames, 12 letter passwords and god knows whatever else. I was mad too about my username but it's only a username it took me 5 min to understand this change. But one thing is really silly!

Well the site knows exactly with user is premium and who isn't. So why when clicking download it takes me to a sub site to choose slow download or fast download. I think people here made a bad decisions and users will gonna quit not only because of their usernames and passwords but also because of the psychological forcing to buy a premium subscription. Staff add only a button, but what the future will brings? 30 seconds timeout with ads for free users next?

Dear Nexus please stop where you are now because you choose the wrong side. The year 2020 should be better not worse! Do not let this happen.P.s. The subscription lifetime plan is little to expensive, make a promo.

I agree wholeheartedly with what you said about psychologically forcing premium, DaisukeNiwaKun. We all know how to opt for a premium account, and we all know that download speeds are capped unless you pay. So why do we need to be taken to a "choice" screen where we are shown - in the same way those tacky file share sites display it - how our choice to use the free version of Nexus is a bad one? The downloads don't take long even at slow speeds, many of them being small, and I have never downloaded anything for which I impatiently waited.

I have paid in the past (under a different account, which is gone now hence the new one; I used to be under the user name "centime") for a premium account, but this hard sell guarantees that I never will again. And I also agree about the price of a lifetime subscription...49.00 UK exchanges to $64.74 US; too much for a game modding site (in my opinion, which counts for nothing to anyone but me). Perhaps if I were younger...

Call me whatever you like, but there is no need for pushing our faces down into the idea of paying for a subscription. Again, we all know how to do it and what is at stake if we don't, but this new tactic will, I believe, turn off a lot of would-be financial contributors to Nexus. This has left such a bad taste I don't think I will be here for too long anyway. Greed is, to me, the most ugly of human attributes.

My primary complaint is how slow the Nexus runs after its "upgrade". Why would we have any faith in the Premium version of downloads when the bloody website can barely load mod pages? It's like it's running on an old AMD cpu from 15 years ago with a dial-up or crappy satellite connection. (Slight exaggeration, but not by much)

I had actually considered upgrading to the premium downloads before the absurd changes, but after seeing how slow the website is now and hearing about when this security breach happened and how long it took for them to notify people about it, I don't think putting money into the website is such a good idea anymore.

It's the unique and strong passwords part of this statement that really matters. Of course longer passwords will help, but ultimately having many complicated and unique passwords will potentially stop you from getting other accounts hacked. The best security guarantee is to not use any services, anything else is a compromise.

nothing guarantees security, but your biggest security threat is bots mass guessing a password, those bots will be scrolling through all potential passwords, and as such a COMPLEX password won't make a notable difference, but each extra character in length will make it take exponentially longer for the bot to guess

Gonna hop in as I did my dissertation on the ease of modern password cracking and I wanna flex

Things note about passwords:1. Each real dictionary word is essentially one character, as dictionary lists are the first things we use2. Anything shorter than 6 characters is not a password3. Using l33t sp33k is useless as rule lists try these with very little increase in effort4. Using personal information in your password is a death sentence, this info can be fished/mined with ease5. Don't use your good pwds on janky old websites, they probably use MD5 and that's pretty much raw text password storage*PLEASE don't use those dice-roll sites they're terribly insecure passwords with modern cracking techniques.

The best passwords are, of course, randomly generated password from things like KeePass2. Though you'll have no chance of remembering them. I think the best passwords would be a short sentance of words purposly spelt wrong with random 'special' chars thrown into the words;